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Abstract 

We introduce a protocol for quantum secret sharing based on reusable entan- 
gled states. The entangled state between the sender and the receiver acts only as 
a carrier to which data bits are entangled by the sender and disentangled from it 
by the receivers, all by local actions of simple gates. We also show that the inter- 
ception by Eve or the cheating of one of the receivers introduces a quantum bit 
error rate (QBER) larger than 25 percent which can be detected by comparing 
a subsequence of the bits. 
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1 Introduction 



The past few years has witnessed progress in theoretical aspects and experimental 
implementations of quantum cryptography. (For an elementary introduction to the 
subject see HI and for a comprehensive review of recent advances see |2j.) 
One of the desirable protocols for secure communication is called secret sharing, the 
simplest of which is when the sender Alice wants to send a secret message to two 
receivers Bob and Charlie so that non of the receivers can recover the message on his 
own. In 1998, Hillery, Buzek, and Berthiaume proposed a quantum solution for secret 
sharing 3 . In their method which is inspired by the quantum key distribution method 
of Bennett and Brasard and Ekert[5|, Alice, Bob and Charlie share a Greenberger- 
Horne-Zeilinger (GHZ) state 6 . They then carry out measurements of their bits in 
either of the two non-commuting bases, say x and y bases in random. Since the results 
or measurements are correlated for half of the cases, they can establish a secret key 
between themselves by announcing their bases of measurements. The aim of the 
present article which is inspired by the work of Zhang, Li and Guo 7 in quantum key 
distribution, is to present an alternative method for secret sharing, which is based on 
sharing entangled states as carriers to which data bits are entangled by the sender 
Alice and disentangled by the receivers Bob and Charlie. The role of this carrier is to 
make communication secure against intervention of evesdroppers or cheating of any 
of the receivers. 

Two remarks are in order comparing the differences of our protocols with the known 
ones ElEl. 

1- If experimental realization of constructing and distributing GHZ states to parties 
at long separation becomes a possibility in the future, it is plausible to assume that 
the maintenance of the correlations of these states will be easier and less costly than 
their creation anew for every round as is needed in earlier protocols for secret sharing. 

2- We should also point out that this protocol is not far from the reach of the near 
future experiments. At present single qubit gates and double qubit gates very close 
to the CNOT gate, can be implemented on individual ions where up to ten ions are 
kept in a coherent state [H]. One can also imagine that by methods similar to the ones 
proposed in [TO:, distant atoms or ions can be entangled with each other in the near 
future. The structure of this paper is as follows: In section 2 we introduce the protocol 
for two receiving parties, and discuss how information is split and is protected from 
unauthorized parties. We also show how intervention of Eve can be detected. We end 
up the paper with conclusions. 

2 The secret sharing protocol with two parties 

Suppose Alice wants to sent a message which is already in the form of a sequence of 
classical bits qi,q2,Q3,- (li = or 1) to Bob and Charlie, so that the receivers 
can infer this message only by their mutual assistance. We begin with our notations. 
We use subscripts a, b, c and e on states and operators for Alice, Bob, Charlie, and 
Eve respectively. Any other space carrying message qubits is specified by numerical 
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subscripts, 1, 2, etc. A controlled gate like CNOT is denoted simply by C, and is 
specified by two subscripts, the first one is the control bit, the second is the target 
bit. Thus Cai is the controlled NOT gate which is controlled by Alice qubit and acts 
on the qubit in line 1, i.e: Cai\q, q')ai = \q,Q + Q')ai, where q and q' are and 1 and 
addition is performed mod two. 

The Hadamard gate acts as H\0) = ^(|0) + |1)) and H\l) = ^(|0) - |1)). By |0) 

and |1), we mean two qubit states which are uniform superposition of basis states the 
sum of whose digits modulo 2 are respectively and 1, i.e: |0) = ^(|0,0) + |1,1)) 

and |T) = ^(|0,1) + |1,0)), which can be identified only by the collaboration of the 
two parties possessing the bits. 

Moreover the following property is also easily verified: 

CalCb2\q)a,b\l')l,'2 = l^)a,fek + q')l,2- (1) 

We also need to define two three-particle states, namely the GHZ state which we 
denote by 

|G):= -^(1000) + 1111)). (2) 
and an even parity state which we denote by 

\E) := i(|000) + 1110) + 1101) + 1011)) ^ ^(|0)|0) + |1)|T)). (3) 

These two states are transformed to each other by the local operation of Hadamard 
gates, that is: 

\G)=H0H0H\E) and \E) = H ^ H H\G) (4) 

We will use these two states which are shared by all three parties, as carriers of 
information, (the \G) state in the odd rounds and the \E) state in the even rounds). 
Alice entangles her data bits to the above carriers and bob and Charlie disentangle 
the data bits from these carriers. Due to property Q), the action of Hadamard gates 
performed by all the parties at the end of each round switches the Carrier to the 
appropriate one for the next round. This switching of carriers is also crucial for the 
security of the protocol as we will see in the sequel. 

For sending a classical bit q Alice may encode it as a state \q, q) and send this state 
simply to Bob and Charlie. At the destination Bob and Charlie can measure their 
corresponding bits and recover the bit q. In this case Bob and Charlie can understand 
q without each other's assistance, and in fact Alice sends half of the bits say the odd 
numbered ones Qi, (?3, ^5 • • • in this way. For the other half, 92, '?4; % • • she encodes a 
bit q in the form of a state \q) = -^(lO, q) + \l,q + l)) and sends it to Bob and Charlie 
who are assumed to have access to the first and second spaces respectively. Any such 
state gives no information at all to either Bob or Charlie, since the density matrix of 
each of them is easily seen to be completely mixed. However they can identify the bit 
q by communicating to each other the result of their measurements. The value of the 
bit q is simply obtained by adding their result mod 2. In this way Alice can split a 
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message so that Bob and Charlie can recover the message only by their cooperation. 
A cheating of the kind of wrong declaration of the results by one of the receivers leads 
to 50 percent errors which is easily detected by comparing a subsequence of the bits 
received with those actually sent by Alice. By this comparison Alice finds that at 
least one of the receivers has been dishonest. Although she can not determine which 
one. 

This is the part of protocol which deals with splitting of information. Now we are 
faced with the problem of protecting information against Eavesdropping and against 
cheating of one of the parties who may find access via the collaboration of Eve to 
both the qubits. 

We should assume that the quantum channel used by Alice for sending the qubits is 
not secure and can be penetrated by an unauthorized third party called Eve (who 
incidentally may be one of the dishonest receivers say Bob) finding access to both of 
the bits in transition and retrieving the data (without assistance of Charlie). We now 
make our protocol safe against such attacks or cheating. The strategy is to entangle 
the message qubits with an already entangled state in possession of Alice, Bob and 
Charlie, in a highly mixed form, so that while being sent, these qubits if accessed 
by Eve or by one of the receivers say Bob, carry no information at all. Moreover we 
should also show that Eve's intervention and Bob's cheating can be detected by the 
other parties. We use two different forms of carriers for odd and even bits. For odd 
bits, we proceed as follows. Alice entangles the state \qq)i2 to the already present 
GHZ state \G)abc by performing CNOT gates CaiCa2 on 

\G)abMq)l2 = ^(|0'0,0) + |l,l,l))a,fe,ek,g)l2 (5) 

to produce the state: 

l^odd^ = -^(|0,0,0),feek,g)l2 + |l,l,l)a,b,c|l + '?,l + 9>12) (6) 

At the destination. Bob and Charlie act on this state by the operators Chi and Cc2 
and extract the state |(?, (/)i,2 where each one of them can read independently his 
own bit. By her action Alice has entangled the double bit 5)1,2 so that while in 
transmission it is a mixture of \q,q) and \1 + q,l + q) which conveys no information 
to Eve about the value of the bit being sent. 

It is also seen from the state © that a simple intercept-resend strategy adopted by 
Eve of the two flying data qubits, will make 50 percent error in the data bits jointly 
received by Bob and Charlie with those sent by Alice. Therefore Eve's presence can 
be detected by publicly comparing a subsequence of the bits sent by Alice with those 
received by Bob and Charlie. 

For the even bits which are encoded as states \q), i.e. (|0) = "^(|00) + |11)) and 
|1) = -^(lOl) + llO)))) Alice entangles this state to the carrier \E) by performing only 
one single CNOT gate Cai on 

\E)abc 55 \q)l2 = 4^(|0)|0) + \l)\l))abc\q)l,2 (7) 
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to produce the state 




where we have used the the property At the destination, Bob and Charhe act on 
this state by the operators Cbi and Cc2 where again by (0) they extract |g)i,2 which 
they can identify completely only by their collaboration. It is quite simple to see from 
(jEJ that pbi = Pc2 = Pi2 = ^I- 

This means that neither Eve alone who may supposedly find access to the two 
data bits nor any of the receivers independently, can find the data bit which has 
been encoded and sent by Alice. For the even rounds the simple intercept-resend 
strategy of Eve introduces 50 percent discrepancy among the data bits of Bob with 
those of Charlie which again leads to the detection of Eve, since a state which has 
been encoded as |0) = "^(|00) + |11)) is received half the time by Bob and Charlie 

as a state |1) = -^(lOl) + |10)). 

Note that once the data bits are measured by Bob and Charlie, only one of them 
needs to publicly announce the result of his measurement, and the other will find 
the actual bit sent by Alice, by simply adding the bit publicly announced to the one 
that he has actually measured. This public announcement again does not convey any 
information to Eve. Moreover a wrong declaration of results by one of the receivers 
say Bob again leads to discrepancies of the bits between Alice and Charlie. 
Before going on to study a general attack of Eve or Cheating of Bob, lets finish the 
protocol by saying how Alice, Bob and Charlie switch their entangled state from the 
GHZ state |G) 

(J h e for odd rounds to the even state |ii')a,fe,c state for even rounds. 
They can do this simply by performing Hadamard gates on their respective states at 
the end of every round of the protocol. The reason is relation Thus they start 
the first round with the GHZ state \G) and end up with the \E) state which is used 
for the second round. At the end of the second round they have produced again the 
GHZ state \G) which will be used for the next round and so on. 
We now assume that Eve who may be a collaborator of one of the receivers say Bob 
follows a more complicated strategy by entangling her system (ancilla) with the states 
of Alice, Bob and Charlie in the most general form, that is: 

\&)a,b,c,e = ^\hj,k)abc^Vijk hj, k = 0,l. (9) 

where rjij^s are un-normalized states of Eve. Eve wants to make this entanglement so 
that at the end of each round of sending and receiving a bit, useful information about 
that bit is collected in her ancilla which she can measure safely later on. Consider 
an odd round of the process and suppose that the starting state of Alice, Bob and 
Charlie, ignorant of the presence of Eve is as above. Eve is clever enough to entangle 
her state such that she does not perturb the values of the final bits measured by 
Bob and Charlie when the protocol is run for this round, (otherwise a comparison 
of a substring of bits between Alice and Bob and Charlie, will reveal her presence or 
her collaboration with one of the receivers.). She then finds that the ideal form of 
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entanglement is as follows: 



19°'^'^) = |0,0,0)r/ooo + |l,l,l)mii- (10) 

where we have suppressed the subscripts on the states and the symbol. If she keeps 
any other state in H10|). say a state like |0, 1, l)??oii, the total superposition will have 
a term |0, 1, 1, q, g)ryoii which reveals the encoded bit q by Alice as 1 + g to Bob and 
Charlie. Or if she keeps a state like |0, 1,0)77010; the total superposition will have a 
term |0, 1, 0, q, g')r?oii which reveals the encoded bit q by Alice as 1 + g to Bob and as 
q to Charlie. In all cases these lead to her detection after a subsequence of bits are 
compared. A similar analysis reveals to Eve that the ideal form of entanglement for 
an even round of the protocol is: 

|e^^^") = 10,0,0)^000 + 11,1,0)^110 + 11,0,1)^101 + 10,1,1)^011 (11) 

The crucial point is that the Hadamard gates at the end of each round do not allow Eve 
to have desirable entanglement for every round. Eve can have desirable entanglement 
only if i/®3|Qei)en^ _ |Qodd>^ ^jg^ versa. A simple calculation yields: 



^®3|0odd^^ _i_ (|o,0,0) + |110) + |l,0,l) + |011))(r?ooo + ??iii) 

+ ^ (|l,l,l) + |0,0,l)+|010) + |100))(r?ooo-??iii). (12) 

Equating this to \Q'''"'''^) yeilds rjooo = rjui and ,^000 = 610 = 601 = ■^oii- Looking 
back at (fTO|) and (fTTf) . we see that this implies that this switching between desirable 
entanglement at alternative rounds is possible for Eve only if there is no entanglement 
at all in any of the rounds! One may argue that Eve may not want to completely avoid 
any error introduced into the data and she may entangle her system to the carriers 
in order to reduce the quantum bit error rate (QBER) as low as possible, lower than 
the expected level of noise and hence escape the detection . We will show in the 
appendix, that Eve can not lower the QBER averaged over odd and even rounds, 
below 25 percent. In this way we have shown the security of the protocol against 
Eve's attack or Bob's Cheating. 

In conclusion we have presented a new protocol for quantum secret sharing based on 
reusable entangled states. In our protocol a sequence of bits is transmitted to two 
parties so that they can recover half of the bits independently and for the rest half 
they need to collaborate to find the identity of the bits. The distinctive feature of this 
protocol is the existence of a carrier which carries the data bits from the sender to 
the receiver in secure form, without any need for measurements in random bases and 
public announcements. We have also discussed the security of the protocol against 
evesdropping and against cheating of one of the receivers, and have shown that any 
such action leads to high error rates in the sequence of bits between the participants. 
A rigorous proof of the security of the protocol is however beyond the scope of the 
present work. 
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3 Appendix 



This appendix is a completion of section 3, where we show that even if we Eve ahows 
a small quantum bit error rate introduced into the data, she can not find any form of 
entanglement of her system to the carriers to achieve this goal. Suppose that in the 
odd and even rounds Eve entangles her system to the carriers in the following general 
forms: 

16°'^'^) = |0)??o + \l)vi + |2)r/2 + |3)r?3 + |4)r?4 + |5)??5 + |6)r?6 + \7)r]7- (13) 

and 

|G— ) = |0)Co + 11)6 + 12)6 + 13)6 + |4)6 + |5)6 + 16)6 + |7)6- (14) 

where for simplicity we have used binary notation and suppressed indices, i.e. |0)6 = 
|000)afec "X" 6) |3)6 = |011)abc 6 ^tc. In order to reduce the QBER (the probability 
of unwanted bits introduced into the transferred bits) below a tolerable threshold e, 
she should choose the states such that: 

Imp + Imp + Imp + Imp + Imp + Imp < or |?7op + Imp > i - e (15) 

in the odd rounds and 

|6P + l6P + l6P + l6P<e. (16) 

However the action of Hadamard gates relates the two states |0°'^<^) and |0'^'"^") and 
hence the states {r]i} and {6}- It is easy to find that under the Hadamard operations: 
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(17) 



A simple rearrangement yields 

I6P + I6P + I6P + I6P = 

-(Im-ml +lm-ml +lm-ml +lm-ml) 

> ^(Im-mP + lm-mP) - ^ (is) 

where in the last line we have used (|15|) . Therefore we see that keeping the QBER 
below a very small threshold e in the odd rounds, will introduce a QBER of about 50 
percent in the even rounds and vice versa. The average QBER over the odd and even 
rounds is ^(e + ^~^) = and the best that Eve can do is to minimize this average 
to 25 percent by minimizing e. 
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